Executive brief
TensorFlow is a widely-used open-source machine learning library. The QuantizedMaxPool operation contains a vulnerability where specially crafted input parameters can cause a null pointer dereference, leading to application crashes and denial of service. An attacker can exploit this by providing malformed inputs to crash TensorFlow-based services.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the QuantizedMaxPool operation within TensorFlow's quantized pooling kernel. The root cause is a reference binding to a null pointer when user-controlled inputs (min_input and max_input tensors) are empty or malformed. An attacker with the ability to call TensorFlow operations (local or via an exposed ML inference API) can trigger this by providing an empty min_input or max_input parameter while executing QuantizedMaxPool. Successful exploitation causes an undefined behavior condition that typically results in a crash, achieving denial of service. Patches are available in TensorFlow 2.5.3, 2.6.3, 2.7.1, and 2.8.0.
Affected products
- Google TensorFlow All versions before 2.5.3; 2.6.0–2.6.2; 2.7.0
- Google TensorFlow CPU All versions before 2.5.3; 2.6.0–2.6.2; 2.7.0
- Google TensorFlow GPU All versions before 2.5.3; 2.6.0–2.6.2; 2.7.0
Timeline
- 2022-02-02: disclosed: Advisory published by TensorFlow security team
- 2022-02-09: patched: Patch released in TensorFlow 2.5.3, 2.6.3, 2.7.1, and 2.8.0